yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] biktor_gj:
well, after loading msm nand ext module mtds 5 to 11 should appear, and even if its scattered data through 9 and 11 you should definitely see something. which sw version are you using? im sticking with 024 for tests...

about usbloader, nand is working fine, you can write wherever you want, the problem is finding a spot where you dont break any critical data. theres a function on the nand driver which is used to read flash (flash_read_ext) i had partial success reading and showing on screen, but im cloning the download function so it uploads to the pc, and havent had time to touch fastboot binary to implement a 'get partition' command so it can send the command to the phone and get what it sends to a file (something like fastboot getpart system), so we can really see how the flash is organised.after i know where im stepping i will overwrite the elf header on the beginning of the boot image and put usbloader with an elf header in there... and pray :)

when i get home i can send you some sources (pm me if you want them)

of the usbloader with working nand) so you can take a look...
[XPERIA X10 Android Development] Bin4ry:
Thanks for reply. But i don't think that we are able to boot it (except of gorohs diag image nothing boots after usbloader).

But we can try to integrate into fastbootloader/usbloader. Feel free to edit some lines into ;) I have uploaded the source a few pages back.

I think first we have to integrate the imagedump well (like biktor is also trying :P).

And latest tests has shown that we are able to write into some areas. Biktor has sucessfully flashed some parts onto the phone through usb-/fastbootloader.

After his flash first all was normal, but the systempartition was full of stuff he flashed, so if we find right areas of partition we can try to flash it right there.

In my opinion we should be able to exchange systempartition if we correct the areas to write.

All we have to do is letting the build.prop inside our new image and the phone will boot, becase build.prop is the only signed file. So all that we need is a safe way of flashing partitions. (For kernel we have to check if it is checked at all. I think that nothing is checked except of the prop's in system and recovery)

Regards

Bin4ry
[XPERIA X10 Android Development] maxrfon:
Ok just PMed you.

When i see the things you see i could understand more.
[XPERIA X10 Android Development] maxrfon:
According to S1Boot policy everything should have signature, otherwise it should not start.

I have had a chance to take a look at SE's engineering software and i keep in mind some things from it.

Surely i can tell you about all what we need after i get the image of the S1Boot, i have my IDA 6.0 to help ;)
[XPERIA X10 Android Development] maxrfon:
Yes this is what i mean, we need our custom software to have access to hardware when the system is not running, so the usbloader function is pretty good for that.

It's like custom fastboot, so it fits Perfect!

My knowledge of linux is not that good, but in all other fields i am ok.
[XPERIA X10 Android Development] maxrfon:
Yes those modules are dummy, unused space of the Android part of the nand chip.

And it's FF.

9 and 11 does not show me anything of what i can recognize...

Checking my version..

Dunno what you mean, so i will post all i see:

Firmware = 1.6

Base band 1.1.25

kernel 2.6.29-rel

Buld R2BA020
[XPERIA X10 Android Development] Bin4ry:
Okay, then lets wait for biktor and his usbloader. I think he has worked more than me on it in the last time, because i had no time the last weeks :/

What he wrote sounds good and exactly like this what i wanted to do ;)

After we have a version which can dump to pc, we can implement more and more over time (just like we need).

Regards

Bin4ry
[XPERIA X10 Android Development] maxrfon:
Ganz genau :)

Let's wait for him.
[XPERIA X10 Android Development] Bin4ry:
Better then double working on the same thing ;)

Regards

Bin4ry
[XPERIA X10 Android Development] maxrfon:
Btw where is Goroh?

Does anyone know if he is ok?
[XPERIA X10 Android Development] zdzihu:
Gentlemen,

Glad to see you're still here. I'm riding my wild Celeron500 now, but not giving up yet :)

Anyway... you can override partition table using kernel command line. So I tried (via kexec) and it worked.

'mtdparts=msm_nand:0x00440000@0x3fbc0000(appslog),0x06f40000@0x38c80000(cache),0x160a0000@0x05ae0000(system),0x1d100000@0x1bb80000(userdata),0x0001FFFF@0x00000000(loader)'

dev: size erasesize name
mtd0: 00440000 00020000 "appslog"
mtd1: 06f40000 00020000 "cache"
mtd2: 160a0000 00020000 "system"
mtd3: 1d100000 00020000 "userdata"
mtd4: 0001FFFF 00020000 "loader"

0x00003fbc0000-0x000040000000 : "appslog"
0x000038c80000-0x00003fbc0000 : "cache"
0x000005ae0000-0x00001bb80000 : "system"
0x00001bb80000-0x000038c80000 : "userdata"
0x000000000000-0x00000001FFFF : "loader"

but the dump is still a bunch of FFs. Are the addressess ok? Is it worth trying to dump the stuff early (using nand_dump from within ramdisk), or will I get same results again?

Cheers!
[XPERIA X10 Android Development] maxrfon:
Well, we can't get anything using the system, i bet it filters requests or whatever it does the AMSS area is restricted.

All we can do is to guess where to search. I found that from fastboot we can control the nand chip select and it shows pretty good results.

I even wonder why on a chip with capacity of 1Gb we have spare place like 120Mb to install software.. Huh? So it means the chip is divided in two.. Read the posts i wrote for like fror two pages back. The AMSS start address and end address and this tells something.. The phone and bootloader communicates with nand via the dma buffer, this i will also research soon to see what and who it wants and what address it requests.

But thanks for such an easy way to add partitions. Please do continue your research, if we dig dig dig then we will dig out something and to win SE phone is not to win all other androids, it's to win the best security ever!

Regading ram disk - yes, we need to get handle to the nand before the os does or within the ramdisk. My problem is lack of linux programing, otherwise i would have found it and set a huge and fat POINT at this topic.. Oops.. i am not too ambitious :) I do it last 15 years ;)
[XPERIA X10 Android Development] zdzihu:
I dumped from 0x00000000 to 0x05ae0000 with dump_image and it was full of FFs + a lot of ECC errors. However, dumping /dev/mtd/mtd4 with dd gave me nice 90Mb file with some data, would you mind to take a look in your spare time? I guess it's all rubbish...

http://www.mediafire.com/?5rf32f1v3692gze

Anyway, I'm reading last few pages to catch up :)
[XPERIA X10 Android Development] skoperst:
spl.bin

I got the spl.bin after insmoding the io_ex2.ko to the x10 mini(I'm unable to get the splboot module for the x10).

When I try to write back to /proc/spl I get I/O writing error.

Why is it happening? Is it possible to modify the kernel module to enable such writings? or its useless?

Sorry for the noob question.
[XPERIA X10 Android Development] pulpoff:
Actually afaik all the reason to load splboot module is to expose the bootloader and thus be able to READ it. Normally its not available after the boot.

Now, writing to this virtual device is pointless, its not gonna change the actual bootloader.
[XPERIA X10 Android Development] maxrfon:
flash_init

Well, as i see the main problem of the usbloader is flash_init.

Whatever i do i can't make it work. Therefore, without this initialization erase & write can't properly work.

Anyone had any success with it?
[XPERIA X10 Android Development] biktor_gj:
It crashes sometimes on my phone, but most of the time it inits just fine. I think if Android is writing or reading from the nand in the exact time you do the 'echo' it sometimes gets stucked in there trying to re-initialize the nand... Try loading the image to splboot, then wait until the screen goes off, then light up the lcd by pressing and holding the back key and while you keep it that way launch the echo command to splboot to make it boot. That's how I do it at least, and it seems to do the job :)
[XPERIA X10 Android Development] maxrfon:
Hi,

Up to the flash_nand_read_config everything goes just fine.

Then it crashes.

Maybe i have some other hardware? I am not dumb at all ;) but i can't even run the sources you sent by email. Btw did you check email Biktor? :)

So just tried to give it fake CFG1 and CFG0, let's see.

And pls, Biktor, check email and maybe you can find a few mins for me in gtalk?

Thanks!

m
[XPERIA X10 Android Development] maxrfon:
Btw it's normal X10 that i have.
[XPERIA X10 Android Development] maxrfon:
It's just a wonder!

After playing a bit with the code i realized that to work with nand we must use this idiotic dma layer of the super fast nand....

Normaly this code :

void nand_select(unsigned char chip)
{
int i;
*(volatile unsigned int*)NAND_FLASH_CHIP_SELECT = 0 | chip;
*(volatile unsigned int*)NAND_FLASH_CMD = 0x0d;
*(volatile unsigned int*)NAND_EXEC_CMD = 1;
while(*(volatile unsigned int*)NAND_EXEC_CMD)
;
*(volatile unsigned int*)NAND_FLASH_CHIP_SELECT = 0 | chip;
*(volatile unsigned int*)NAND_FLASH_CMD = 1;
*(volatile unsigned int*)NAND_EXEC_CMD = 1;
while(*(volatile unsigned int*)NAND_EXEC_CMD)
;
*(volatile unsigned int*)NAND_DEV0_CFG0 = 0xaa000000;
*(volatile unsigned int*)NAND_DEV0_CFG1 = 00;
*(volatile unsigned int*)NAND_ADDR0 = 0;
*(volatile unsigned int*)NAND_ADDR1 = 0;
*(volatile unsigned int*)NAND_FLASH_CMD = 0x32;
*(volatile unsigned int*)NAND_EXEC_CMD = 1;
while(*(volatile unsigned int*)NAND_EXEC_CMD)
;
for (i = 0; i <0x60; i++)
;
}
unsigned int nand_read_id()
{
unsigned short res;
*(volatile unsigned int*)NAND_EXEC_CMD = 1;
while(*(volatile unsigned int*)NAND_EXEC_CMD)
;
//*(volatile unsigned int*)NAND_DEV0_CFG0 = 0xAAD40000;
*(volatile unsigned int*)NAND_FLASH_CMD = NAND_CMD_FETCH_ID;
*(volatile unsigned int*)NAND_EXEC_CMD = 1;
while(*(volatile unsigned int*)NAND_EXEC_CMD)
;
res = *(volatile unsigned int*)NAND_READ_ID;
return res;
}
int _main(unsigned zero, unsigned type, unsigned tags)
{
int n;
mmu_off();
nand_select(4);
fl_id = nand_read_id();
nand_select(2);
fl_id1 = nand_read_id();
boot_from_flash = 0;
linux_type = board_machtype();
linux_tags = 0;
for(n = 0; n < KEYPAD_DELAY; n++) {
boot_poll();
}

check_reboot_reason();
if(!boot_from_flash) {

DISPLAY_MSG("Switched to fastboot mode...\n");

if (!usb_initialized) {
usbloader_init();
usb_initialized = 1;
}

/* scan the keyboard and detect charger and start charging */
for(;;) {
if(is_usb_charging()) {
/* if USB charging is in progress, poll both USB and keypad */
boot_poll();
} else {
/* USB charging suspended; this is due to in-progress data transfer
so poll only the USB
*/
usb_poll();
}

if(stop_charging == 1) {
DISPLAY_MSG("Continue boot...\n");
break;
}
}
boot_from_flash = 1;
usb_charger_reset();
}
return 0;
}

would work like a charm...

Here all i get is fl_id 00000000....

Unbelievable!

Would be nice to shut down the DMA controller and work with nand directly, but how..
[XPERIA X10 Android Development] maxrfon:
"Try loading the image to splboot, then wait until the screen goes off, then light up the lcd by pressing and holding the back key and while you keep it that way launch the echo command to splboot to make it boot. That's how I do it at least, and it seems to do the job"

No way.. Once it happened and no more..

It does not wake up from pushing the back button, so i press either power or the middle button, then i press and hold the back button, echo the boot, phone restarts and flash_init...

Pufff..
[XPERIA X10 Android Development] maxrfon:
Dunno if it's good news or bad but:

Got the S1Boot from the nand, but X10 mini. The concept is hopefully the same with X10 big.

Just FYI.
[XPERIA X10 Android Development] Bin4ry:
Definetly good news :P

Can you share some more informations please? I'm still working on my own, because i have not much internet this week :/ Only some free WLANs here that i can use for checking informations :)

Regards

Bin4ry
[XPERIA X10 Android Development] maxrfon:
Yes i can for sure, PM me your email.
[XPERIA X10 Android Development] zdzihu:
Great news Maxrfon! I'd be interested to have a look aswell if you don't mind :)
[XPERIA X10 Android Development] maxrfon:
Check email :)

Guys come ON and help me!

I need only the flash_init to be passed and then i will try to take control over the SE..
[XPERIA X10 Android Development] maxrfon:
So what i see as the next task is to load this(need to modify and adopt for x10 big) SPL to it's RAM address and run..

Hmm but there is still a task to find out if the original & this (as it's also original) SPL checks the SIN header of the Kernel before to launch it or it just checks it to flash to the nand?

If there is no check before launch we can easy flash customized kernel then...

And then and then..

Otherwise we will need to launch the modified SPL before uploading the kernel to it's RAM from USB.

Yet no more ways i can find.

Oh almost forgot, got the SPL from X10 big just now! :)

P.S Hey guys, how do you add donation buttons? :) LOL i need it now :) 4 months doing nothing but this SE! :)
[XPERIA X10 Android Development] maxrfon:
Emm one more thing.. I will share my founding with people related to Devs, please consider this before asking me in PM.

If you want to contribute - please show us your skills and welcome to our research/dev, but just because of plain interest i'll better spend more time with IDA :)
[XPERIA X10 Android Development] maxrfon:
Need help,

What peripheral is at 0xB800094C in SE/QCOM?

EDIT: Answered myself..

Closed :)
[XPERIA X10 Android Development] Sahandroid:
I am only trying to contribute. I saw that a 2.1 ROM had been released, however, not with the ability to be flashed without EMMA or something. Does this link help in anyway?

http://emma.extranet.sonyericsson.com/
[XPERIA X10 Android Development] maxrfon:
Where was it announced?

I keep my nose only in my pc last few months, so i might have something missed:)

EDIT:

Regarding EMMA - they are so proud of the protection so they put the most important tool on the web for download :)

So that's pretty useless without a bunch of dongles and passwords.
[XPERIA X10 Android Development] fjnty5:
http://xdaforums.com/showthread.php?t=820315

2.1 update for dev phones, just thought id post since you guys read here more than other threads :), ill donate $20 for your great work on friday my friend.
[XPERIA X10 Android Development] jerpelea:
now we have 2 new 2.1 roms

http://xdaforums.com/showthread.php?t=683793
[XPERIA X10 Android Development] Hawkysoft:
i just downloaded the emma tool, now i see lotsa files in the directorys named like USBdrivers, Handshake etc, all in jar files so simply rename em to .rar and extract em, after u done that u should be able to read em in a c++ builder?

just some ideas to help you guys out, maybe its stupid but was thinkin if that program has to communicate/handshake to our devices to mod/upgrade em the answer must be in there right?

--

p.s. cant we bypass emma with ollydbg?
[XPERIA X10 Android Development] :
Yes. http://forums.se-nse.net/topic/52325-seus-firmware-decryptor-encryptor/
[XPERIA X10 Android Development] MarylandCookie:
I already have that :D thanks to Bin4ry.

I was curious to know how far Mayank has got to on his work on this... no harm in having alternatives :)
[XPERIA X10 Android Development] gled:
Hi Maxrfon,

Could I take a look too please ?

I'm not an android dev ( but don't worry, I'm not afraid of a bunch of code, no matter the form... ), but I've some free time and maybe I'll see something ( you know this thing with fresh ideas and new look on projects ... )

Regards,

Gled.
[XPERIA X10 Android Development] androidfanboi:
Brute Force

I have written my own Brute Force Engine in delphi some time ago, will eventually crack any code length numbers characters the lot as long as there are no - you tried to log in too many times please wait 15minutes security implemented--as this would take a lifetime otherwise--- all i need to know is what you want me to do, all i need to tell the engine is what it is trying to crack.

if you wish for me to help on this inbox me

Been reading the last few pages of this and this gpu sounds good, i could modify this program to work in this manner, to be honest iv been waiting round months for this cracked bootloader, havent been able to help in anyway as linux not my strong point. but if it would take a certain amount of extra time to actually get it cracked, its more than worth a shot than waiting around and not helping out?
[XPERIA X10 Android Development] SuperUserMovado:
http://www.engadget.com/2010/10/28/chinas-tianhe-1a-is-now-worlds-fastest-supercomputer-plans-to/

Maybe if we can ask the chinese to let us borrow their computer, it would not take so long.
[XPERIA X10 Android Development] mayank.1love:
I have not done too much just decompiled various jars inside the SEUS and got to know that all the methods for flashing new firmware and most probably unlocking are inside the jar files only. Due to my incomplete knowledge of assembly language I am unable to fully understand the assembly language code inside the jar files. Assembly language codes are passed to java JVM via the jar files. If anyone have good knowledge of assembly language do try to look into the decompiled jar files.

Most people in XDA have pointed out that SEUS does not have any access to mobile bootloader but in my opinion it must have some methods inside it to access and modify bootloader in case SE wants to implement new bootloader with new security into our mobiles. Also most of the jars in SEUS are just like jars in EMMA. The full knowledge of this can only be obtained by reading the codes inside SEUS jar files.

One more thing I want to point out that I got from SEUS is that when we flash a new firmware to our mobile through SEUS it gets a ".ser" file alongwith 3 firmware files. This ".ser" file is actually a java ".class" file which can also be decompiled through DJ java decompiler to find out various codes in java. The ".ser" file is actually a set of codes that SE server sends to SEUS to tell it to do whatever they want it to do. The ".ser" file is basically "serialization" file. It includes import of various classes from SEUS plugins jar files which have all the methods inbuilt in them and contains all the steps involved like calling specific methods from the classes to flash the mobile with the firmware files that SE wants.

In my opinion we can also try to implement methods only available to EMMA by copying or modifying the SEUS jars to include the functions and later calling them by our own ".ser" file. To pass our own ".ser" file to SEUS we must first know the exact methods available to SEUS and import all the needed classes in our ".ser" java file and then write all the codes we need SEUS to perform on our mobile. We compile that java file to make a .class file and then rename it to ".ser" file. Later we need to make our local server where we will forge the SE server requests. When SEUS calls for any ".ser" file at last step from SE server we'll provide it with our own compiled ".ser" from our local server thus overriding the SE server with our server ".ser" file :)

Till now I just have this much knowledge about the SEUS and jars inside it. If anyone wants to help in this direction they must analyze specifically the assembly code part of jar files which most probably contains "magic bytes" that needs to be sent to our mobile to access specific regions in the mobile memory.
[XPERIA X10 Android Development] brett19:
Would anyone be able to point me in the direction of the JAR files that you were looking to disassemble? As well as any particular parts of it that peaked your interest.

Thanks, Brett
[XPERIA X10 Android Development] sim-value:
Look in your SEUS installation Directory
[XPERIA X10 Android Development] maxrfon:
Hi Gled,

A better contribution would be to help to figure out why the nand is not accessible from the usbloader.

All other tasks are yet in queue, since this one is of a high priority.

Download the splboot_5 sources and take a look at splboot.c you will see the idea of usbloader loading. But the problem is the nand dma buffer is either locked or busy so we can't communicate with it.

There should be a few lines more, like to free dma buffer and let other than msm_nand drivers access the flash, because as i see from the kernel sources it has exclusive access to nand.

Then we can go further.

Max
[XPERIA X10 Android Development] x10_lynx:
noob-question

version 2.0.A.0.497 certified on 28.10. - my question:

why poeple with retail mobiles can flash this version via emma befor official certification?

is emma setting an flag on the bootloader to ignor missing certificate?

how emma set up the image or bootloader for booting without certificate on retail phones?

will this method give a way to boot custom roms?

(stupid question? - sorry!)
[XPERIA X10 Android Development] JamesBarnes:
Im DLing the kernal source at the moment. splboot_5 included? of not, link please. (searched and failed)

Thanks
[XPERIA X10 Android Development] Bin4ry:
I have to go now on a party.

So i attached the tawrite function from flashtool and the new simlock.ta and the old simlock.ta

Please somebody take a look and fix it so that the 2.1 firmware works with flashtool.

Thanks, Over and Out ;)

Bin4ry
[XPERIA X10 Android Development] jiskin:
Hi brett,

I think you can find a part of the source here :

ht tp :// ww w . infos-du-net. c om/forum/276041-21-probleme-java

(Remove the space inside the url, I'm not allow to post link here =) )
[XPERIA X10 Android Development] zdzihu:
Has anyone noticed kexec-tool in new rom? :) It seems to call some kind of shutdown before loading new kernel, but all I've got in last_kmsg was:

[ 422.762056] Starting new kernel

then reboot.
[XPERIA X10 Android Development] HunteronX:
Does that mean that we don't need to create/edit a new bootloader anymore, could we just use kexec to jump to a new froyo rom, including a newer kernel (using chroot?).
[XPERIA X10 Android Development] zephyrix:
Check out s1_verification_test

It checks the SIN headers. Perhaps analyzing this could be helpful.
[XPERIA X10 Android Development] brett19:
Already done; it generates a SHA-1 / RSA Signature from the data that your uploading to the device and ensures that its actually from SE, if it doesn't match, then the flashing fails, RSA Signatures arn't (easily) crackable at this point, so doing that would be futile, what we need to do is somehow flash firmware to the phone without going through the current bootloader ( which is what does the Signature checking ).

Cheers, Brett
[XPERIA X10 Android Development] zephyrix:
Obviously... but what is the purpose of this binary if the bootloader already performs a check?
[XPERIA X10 Android Development] brett19:
Which Binary?
[XPERIA X10 Android Development] Umeaboy:
Development of the kernel

I'm sorry if this gets offtopic, but I went to SE's website to check the Dev-department.

If I'm not misstaken......

http://developer.sonyericsson.com/cws/download/1/842/205/1285240248/X10_Donut_100721_01.tar.bz2 is the kernel, right?
[XPERIA X10 Android Development] zephyrix:
... the one named s1_verification_test in /system/bin
[XPERIA X10 Android Development] brett19:
S1 is the name of the protocol that is used to speak between the Flasher and the Device, I assume its some sort of other check? I will look afterwards, I believe its just the code for the SHA1/RSA Signature check.

Cheers, Brett

Edit: Actually, would you mind uploading that binary somewhere so I can take a look at it?
[XPERIA X10 Android Development] thermoska:
here you are ;)

http://www.2shared.com/file/Lt3_0X_C/s1_verification_test.html